v0.3.14-pre.013

2026-09-12 20:43:43 +02:00
parent 8a0717c839
commit 09c91172ae
7 changed files with 537 additions and 9 deletions
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,12 +1,12 @@
 # file: Cargo.toml
-# version: 587
+# version: 588

 [workspace]
 resolver = "3"
 members = ["crates/ksp-app-backfill-desk", "crates/ksp-app-config-desk", "crates/ksp-app-solprices-desk", "crates/ksp-app-store-desk", "crates/ksp-app-wallet-desk", "crates/ksp-config-lib", "crates/ksp-core-lib", "crates/ksp-interface-lib", "crates/ksp-job-api", "crates/ksp-job-backfill-lib", "crates/ksp-logging-lib", "crates/ksp-offchain-transport-lib", "crates/ksp-onchain-transport-lib", "crates/ksp-program-api", "crates/ksp-raw-transaction-lib", "crates/ksp-store-api", "crates/ksp-store-lib", "crates/ksp-store-postgres-lib", "crates/ksp-wallet-lib", "crates/ksp-worker-api", "crates/ksp-worker-raw-transaction-ingest-lib"]

 [workspace.package]
-version = "0.3.14-pre.12"
+version = "0.3.14-pre.13"
 edition = "2024"
 license = "MIT"
 repository = "https://git.sasedev.com/Sasedev/khadhroony-solana-project"
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/cross_layer_completeness.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/cross_layer_completeness.rs
@@ -1,7 +1,7 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/cross_layer_completeness.rs
-// version: 2
+// version: 3

-//! Cross-layer completeness and security canaries through `0.3.13-pre.012`.
+//! Cross-layer completeness and security canaries through `0.3.14-pre.013`.

 fn dependency_names(manifest: &str) -> std::vec::Vec<&str> {
    let mut section = "";
@@ -363,3 +363,127 @@ fn v0_3_13_pre_012_security_redaction_matrix_covers_all_live_sources_and_lower_l
    assert!(postgres.contains("pre_009_backend_error_bridge_cannot_retain_external_error_or_secret_text"));
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline() {
+    let transport_transactions = include_str!("../../ksp-onchain-transport-lib/src/rpc_transactions.rs");
+    let transport_blocks = include_str!("../../ksp-onchain-transport-lib/src/rpc_blocks.rs");
+    let worker_root = include_str!("../src/lib.rs");
+    let worker_resources = include_str!("../src/runtime_resources.rs");
+    let worker_runtime = include_str!("../src/runtime.rs");
+    let worker_persistence = include_str!("../src/persistence.rs");
+    let common_raw_root = include_str!("../../ksp-raw-transaction-lib/src/lib.rs");
+    let store_api_root = include_str!("../../ksp-store-api/src/lib.rs");
+    let store = include_str!("../../ksp-store-lib/src/store.rs");
+    assert!(transport_transactions.contains("pub async fn get_transaction_observed("));
+    assert!(transport_blocks.contains("pub async fn get_block_observed("));
+    for required in [
+        "RawTransactionIngestContinuityContracts",
+        "RawTransactionIngestGlobalHydrationRegistry",
+        "RawTransactionAdmission",
+        "persist_raw_transaction_ingest_converged_acquisition",
+    ] {
+        assert!(
+            worker_root.contains(required) || worker_resources.contains(required) || worker_runtime.contains(required),
+            "pre.013 Worker single-pipeline proof missing: {required}"
+        );
+    }
+    assert!(worker_persistence.contains("ksp_store_lib::RawTransactionWrite::persist_raw_transaction_acquisition"));
+    assert!(common_raw_root.contains("pub use self::acquisition::RawTransactionAcquisition;"));
+    assert!(common_raw_root.contains("pub use self::wire::RawSolanaMessageVersion;"));
+    assert!(store_api_root.contains("pub use self::model::raw_transaction::RawTransaction;"));
+    assert!(store_api_root.contains("pub use self::model::raw_transaction::RawTransactionObservation;"));
+    assert!(store.contains("persist_raw_transaction_acquisition"));
+    assert!(store.contains("record_raw_transaction_observation"));
+    for forbidden in [
+        "ksp_store_postgres_lib::",
+        "ksp_config_lib::",
+        "ksp_job_backfill_lib::",
+        "reqwest::",
+        "tokio_tungstenite::connect_async",
+        "yellowstone_grpc_proto::",
+    ] {
+        assert!(
+            !worker_runtime.contains(forbidden) && !worker_resources.contains(forbidden) && !worker_persistence.contains(forbidden),
+            "pre.013 Worker bypassed the single facade pipeline: {forbidden}"
+        );
+    }
+    return;
+}
+
+#[test]
+fn v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths() {
+    let transport_subscribe = include_str!("../../ksp-onchain-transport-lib/unit_tests/grpc_subscribe.rs");
+    let transport_unary = include_str!("../../ksp-onchain-transport-lib/unit_tests/grpc_unary.rs");
+    let worker_hardening = include_str!("hardening.rs");
+    let worker_root = include_str!("../src/lib.rs");
+    let common_raw = include_str!("../../ksp-raw-transaction-lib/unit_tests/canonical.rs");
+    let store_api = include_str!("../../ksp-store-api/tests/security_hardening.rs");
+    let store = include_str!("../../ksp-store-lib/tests/hardening_completeness.rs");
+    let postgres = include_str!("../../ksp-store-postgres-lib/tests/hardening_completeness.rs");
+    assert!(transport_subscribe.contains("yellowstone_subscribe_debug_omits_filter_names_and_future_payloads"));
+    assert!(transport_unary.contains("yellowstone_remote_status_does_not_copy_message_details_or_metadata"));
+    for required in [
+        "v0_3_14_pre_009_health_policy_is_present_future_coverage_gated_and_source_neutral",
+        "v0_3_14_pre_010_repair_fairness_shares_existing_bounds_without_second_pipeline",
+        "v0_3_14_pre_011_gap_observability_is_bounded_checked_and_redacted",
+        "v0_3_14_pre_012_shutdown_races_are_bounded_across_source_and_worker_drains",
+    ] {
+        assert!(worker_hardening.contains(required), "pre.013 Worker security closure proof missing: {required}");
+    }
+    for forbidden in ["source_key", "provider_gap", "endpoint_gap", "signature_gap", "payload_gap"] {
+        assert!(!worker_root.contains(forbidden), "pre.013 public Worker root leaked sensitive gap material: {forbidden}");
+    }
+    assert!(common_raw.contains("pre_002_material_and_wire_debug_do_not_render_transaction_or_meta_material"));
+    assert!(store_api.contains("pre_007_raw_debug_surfaces_do_not_render_payload_hash_signature_or_account_bytes"));
+    assert!(store.contains("pre_009_secret_canary_never_crosses_settings_or_pre_io_error_debug"));
+    assert!(postgres.contains("pre_009_backend_error_bridge_cannot_retain_external_error_or_secret_text"));
+    return;
+}
+
+#[test]
+fn v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening() {
+    let transport = include_str!("../../ksp-onchain-transport-lib/unit_tests/grpc_subscribe.rs");
+    let worker = include_str!("../unit_tests/runtime_resources.rs");
+    let common_raw = include_str!("../../ksp-raw-transaction-lib/unit_tests/wire.rs");
+    let store_api = include_str!("../../ksp-store-api/tests/public_api.rs");
+    for required in [
+        "yellowstone_transaction_update_decodes_current_storage_wire_including_v1_config_and_meta",
+        "yellowstone_block_update_reuses_transaction_account_entry_dtos_and_preserves_server_counts",
+    ] {
+        assert!(transport.contains(required), "pre.013 Transport Legacy/V0/V1 proof missing: {required}");
+    }
+    for required in [
+        "v0_3_13_pre_004_legacy_v0_v1_block_materials_are_direct_common_raw_with_exact_version_and_index",
+        "v0_3_13_pre_006_http_block_polling_qualifies_legacy_v0_v1_and_rejects_ambiguous_or_future_versions",
+        "v0_3_14_pre_008_proven_full_ledger_epoch_survives_filtered_peer_loss_without_worker_respawn",
+        "v0_3_14_pre_012_source_fault_preserves_first_fault_and_aborts_non_cooperative_sibling",
+    ] {
+        assert!(worker.contains(required), "pre.013 Worker Legacy/V0/V1 or continuity proof missing: {required}");
+    }
+    for required in [
+        "pre_006_legacy_v0_and_v1_wire_goldens_are_exact",
+        "RawSolanaMessageVersion::Legacy",
+        "RawSolanaMessageVersion::V0",
+        "RawSolanaMessageVersion::V1",
+    ] {
+        assert!(common_raw.contains(required), "pre.013 Common RAW version proof missing: {required}");
+    }
+    assert!(store_api.contains("public_pre_003_raw_transaction_and_observation_are_constructible_from_crate_root"));
+    return;
+}
+
+#[test]
+fn v0_3_14_pre_013_worker_and_backfill_remain_independent_producers() {
+    let worker = dependency_names(include_str!("../Cargo.toml"));
+    let backfill = dependency_names(include_str!("../../ksp-job-backfill-lib/Cargo.toml"));
+    assert!(!worker.contains(&"ksp-job-api"));
+    assert!(!worker.contains(&"ksp-job-backfill-lib"));
+    assert!(!backfill.contains(&"ksp-worker-api"));
+    assert!(!backfill.contains(&"ksp-worker-raw-transaction-ingest-lib"));
+    for shared in ["ksp-onchain-transport-lib", "ksp-raw-transaction-lib", "ksp-store-lib"] {
+        assert!(worker.contains(&shared), "Worker common RAW producer edge missing: {shared}");
+        assert!(backfill.contains(&shared), "Backfill common RAW producer edge missing: {shared}");
+    }
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
-// version: 30
+// version: 31

 //! Dependency firewall canaries for the RAW transaction ingest Worker foundation.

@@ -758,3 +758,36 @@ fn v0_3_14_pre_012_shutdown_hardening_stays_worker_local_and_facade_only() {
    }
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_cross_layer_closure_keeps_dependency_and_producer_boundaries_exact() {
+    let manifest = include_str!("../Cargo.toml");
+    let dependencies = dependency_section(manifest);
+    let names = manifest_dependency_names(dependencies);
+    assert_eq!(
+        names,
+        vec![
+            "ksp-core-lib",
+            "ksp-logging-lib",
+            "ksp-onchain-transport-lib",
+            "ksp-raw-transaction-lib",
+            "ksp-store-lib",
+            "ksp-worker-api",
+            "sha2",
+            "tokio",
+        ],
+    );
+    let cross_layer = include_str!("cross_layer_completeness.rs");
+    for required in [
+        "v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline",
+        "v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths",
+        "v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening",
+        "v0_3_14_pre_013_worker_and_backfill_remain_independent_producers",
+    ] {
+        assert!(cross_layer.contains(required), "pre.013 cross-layer closure proof missing: {required}");
+    }
+    for forbidden in ["ksp-config-lib", "ksp-job-api", "ksp-job-backfill-lib", "ksp-store-api", "ksp-store-postgres-lib"] {
+        assert!(!names.contains(&forbidden), "pre.013 Worker dependency boundary expanded: {forbidden}");
+    }
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
-// version: 36
+// version: 37

 //! External public, security, redaction and release-boundary hardening canaries through `v0.3.14-pre.011`.

@@ -1352,3 +1352,25 @@ fn v0_3_14_pre_012_shutdown_races_are_bounded_across_source_and_worker_drains()
    }
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_cross_layer_completeness_security_closure_is_exact_and_redacted() {
+    let cross_layer = include_str!("cross_layer_completeness.rs");
+    let dependency_boundary = include_str!("dependency_boundary.rs");
+    let public_api = include_str!("public_api.rs");
+    for required in [
+        "v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline",
+        "v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths",
+        "v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening",
+        "v0_3_14_pre_013_worker_and_backfill_remain_independent_producers",
+    ] {
+        assert!(cross_layer.contains(required), "pre.013 cross-layer hardening proof missing: {required}");
+    }
+    assert!(dependency_boundary.contains("v0_3_14_pre_013_cross_layer_closure_keeps_dependency_and_producer_boundaries_exact"));
+    assert!(public_api.contains("v0_3_14_pre_013_completeness_closure_adds_no_public_surface"));
+    let root = include_str!("../src/lib.rs");
+    for forbidden in ["source_key", "provider_gap", "endpoint_gap", "signature_gap", "payload_gap", "pub mod "] {
+        assert!(!root.contains(forbidden), "pre.013 public Worker root leaked forbidden material: {forbidden}");
+    }
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
@@ -1,5 +1,5 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
-// version: 23
+// version: 24

 //! External public-surface proofs for the RAW transaction ingest Worker foundation.

@@ -479,3 +479,36 @@ fn v0_3_14_pre_011_gap_observability_is_public_bounded_and_source_neutral() {
    }
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_completeness_closure_adds_no_public_surface() {
+    let root = include_str!("../src/lib.rs");
+    let public_exports = root.lines().filter(|line| line.trim().starts_with("pub use ")).count();
+    assert_eq!(public_exports, 43);
+    for required in [
+        "RawTransactionIngestGapId",
+        "RawTransactionIngestGapReason",
+        "RawTransactionIngestGapSnapshot",
+        "RawTransactionIngestGapState",
+        "RawTransactionIngestRepairMethod",
+        "RawTransactionIngestSnapshot",
+        "RawTransactionIngestWorker",
+    ] {
+        assert!(root.contains(required), "pre.013 expected stable public Worker surface missing: {required}");
+    }
+    for forbidden in [
+        "RawTransactionIngestContinuityContracts",
+        "RawTransactionIngestGlobalHydrationRegistry",
+        "RawTransactionIngestSourceInventory",
+        "RawTransactionIngestTrafficClass",
+        "RawTransactionIngestFairTurnGate",
+        "RawTransactionIngestSourceLossDecision",
+    ] {
+        assert!(
+            !root.lines().any(|line| line.trim().starts_with("pub use ") && line.contains(forbidden)),
+            "pre.013 private type leaked publicly: {forbidden}"
+        );
+    }
+    assert!(!root.contains("pub mod "));
+    return;
+}
--- a/crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
+++ b/crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
@@ -1,7 +1,7 @@
 // file: crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
-// version: 31
+// version: 32

-//! Release-completeness canaries through the `v0.3.14-pre.011` gap observability tranche.
+//! Release-completeness canaries through the `v0.3.14-pre.013` cross-layer closure tranche.

 #[test]
 fn pre_010_production_module_inventory_is_exact() -> std::io::Result<()> {
@@ -441,3 +441,25 @@ fn v0_3_14_pre_012_shutdown_race_canaries_cover_bounded_source_and_worker_drains
    assert!(!root.contains("SourceDrain"));
    return;
 }
+
+#[test]
+fn v0_3_14_pre_013_cross_layer_closure_canaries_are_complete_without_behavior_or_surface_growth() {
+    let cross_layer = include_str!("cross_layer_completeness.rs");
+    let dependency_boundary = include_str!("dependency_boundary.rs");
+    let hardening = include_str!("hardening.rs");
+    let public_api = include_str!("public_api.rs");
+    for required in [
+        "v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline",
+        "v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths",
+        "v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening",
+        "v0_3_14_pre_013_worker_and_backfill_remain_independent_producers",
+    ] {
+        assert!(cross_layer.contains(required), "required pre.013 cross-layer canary missing: {required}");
+    }
+    assert!(dependency_boundary.contains("v0_3_14_pre_013_cross_layer_closure_keeps_dependency_and_producer_boundaries_exact"));
+    assert!(hardening.contains("v0_3_14_pre_013_cross_layer_completeness_security_closure_is_exact_and_redacted"));
+    assert!(public_api.contains("v0_3_14_pre_013_completeness_closure_adds_no_public_surface"));
+    assert!(include_str!("../src/lib.rs").contains("RawTransactionIngestGapSnapshot"));
+    assert!(include_str!("../src/lib.rs").contains("RawTransactionIngestWorker"));
+    return;
+}
--- a/deltas/0.3.14/pre.013.md
+++ b/deltas/0.3.14/pre.013.md
@@ -0,0 +1,294 @@
+<!-- file: deltas/0.3.14/pre.013.md -->
+<!-- version: 1 -->
+
+# Delta `0.3.14-pre.013` — completeness/security cross-layer
+
+## Base requise
+
+```text
+0.3.14-pre.012
+workspace.package.version = 0.3.14-pre.12
+deltas/0.3.14/pre.012.md présent
+```
+
+## Gate de la base
+
+Le gate opérateur de `0.3.14-pre.012` est validé avant ouverture de cette tranche :
+
+```text
+cargo fmt --all : PASS
+cargo fmt --all -- --check : PASS
+audit Rust workspace rules : PASS
+audit Markdown tables : PASS
+cargo check --workspace : PASS
+cargo clippy --workspace --all-targets --all-features -- -D warnings : PASS
+cargo test -p ksp-worker-raw-transaction-ingest-lib --all-targets --all-features : PASS
+```
+
+Le gate Worker comprend notamment :
+
+```text
+152 unit tests : PASS
+cross_layer_completeness : 8 PASS
+dependency_boundary : 20 PASS
+hardening : 37 PASS
+public_api : 21 PASS
+release_completeness : 14 PASS
+```
+
+## Objectif
+
+Implémenter strictement la tranche `pre.013` du plan `035` sans nouveau comportement :
+
+```text
+fermer les canaris Worker / Transport / Common RAW / Store
+prouver que le pipeline d'acquisition/persistence reste unique
+prouver la redaction des chemins gap/repair/terminal
+prouver la non-régression Legacy / V0 / V1 après le hardening 0.3.14
+prouver la séparation bidirectionnelle Worker / Job Backfill
+figer le graphe de dépendances Worker
+figer l'absence de croissance de surface publique
+```
+
+Aucun fichier de production n'est modifié dans cette tranche.
+
+## Pipeline cross-layer unique
+
+Le nouveau canari :
+
+```text
+v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline
+```
+
+vérifie simultanément :
+
+```text
+getTransaction observed reste Transport-owned
+getBlock observed reste Transport-owned
+ContinuityContracts restent privés au Worker
+le registre global d'hydration reste unique
+l'admission centrale reste unique
+la convergence persistence reste unique
+Common RAW reste la représentation canonique commune
+Store API porte RawTransaction + RawTransactionObservation
+Store facade reste l'unique passage vers persistence/observation
+```
+
+Il rejette en plus les bypass directs Worker vers :
+
+```text
+backend Postgres
+Config
+Job Backfill
+reqwest
+tokio-tungstenite bas niveau
+yellowstone-grpc-proto
+```
+
+## Redaction cross-layer
+
+Le canari :
+
+```text
+v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths
+```
+
+ferme ensemble :
+
+```text
+redaction Transport Yellowstone
+redaction des erreurs unary distantes
+health source-neutral pre.009
+fairness privée pre.010
+observabilité gap source-neutral pre.011
+shutdown terminal borné pre.012
+Common RAW Debug redacted
+Store API Debug redacted
+Store facade secret canary
+backend error bridge sans texte externe/secret
+```
+
+Le crate root Worker reste exempt de :
+
+```text
+source_key
+provider_gap
+endpoint_gap
+signature_gap
+payload_gap
+```
+
+## Legacy / V0 / V1
+
+Le canari :
+
+```text
+v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening
+```
+
+réunit les preuves suivantes :
+
+```text
+Transport Yellowstone décode les formes courantes dont V1
+Standard Block et HTTP Block Polling Worker préservent Legacy/V0/V1
+la réconciliation pre.008 ne réécrit pas la représentation RAW
+le shutdown pre.012 ne modifie pas la qualification du matériau
+Common RAW garde ses goldens Legacy/V0/V1
+Store API reste constructible depuis les types RAW communs
+```
+
+Aucune nouvelle logique de version de transaction n'est introduite.
+
+## Séparation Worker / Job Backfill
+
+Le canari :
+
+```text
+v0_3_14_pre_013_worker_and_backfill_remain_independent_producers
+```
+
+prouve depuis les manifests :
+
+```text
+Worker -X-> ksp-job-api
+Worker -X-> ksp-job-backfill-lib
+Job Backfill -X-> ksp-worker-api
+Job Backfill -X-> ksp-worker-raw-transaction-ingest-lib
+```
+
+Les deux producteurs peuvent continuer à partager uniquement les façades communes nécessaires :
+
+```text
+ksp-onchain-transport-lib
+ksp-raw-transaction-lib
+ksp-store-lib
+```
+
+Aucun checkpoint, scheduler ou orchestration commun n'est ajouté.
+
+## Dépendances et API publique
+
+`dependency_boundary` conserve l'inventaire exact Worker :
+
+```text
+ksp-core-lib
+ksp-logging-lib
+ksp-onchain-transport-lib
+ksp-raw-transaction-lib
+ksp-store-lib
+ksp-worker-api
+sha2
+tokio
+```
+
+`public_api` fixe à nouveau :
+
+```text
+43 pub use publics
+aucun pub mod
+aucun ContinuityContracts public
+aucun GlobalHydrationRegistry public
+aucun SourceInventory public
+aucun TrafficClass/FairTurnGate public
+aucun SourceLossDecision public
+```
+
+La surface publique de `pre.011` reste donc la dernière croissance intentionnelle de `0.3.14` avant le gate technique.
+
+## Canaris ajoutés
+
+```text
+cross_layer_completeness
+  v0_3_14_pre_013_gap_repair_closure_keeps_one_transport_worker_common_raw_store_pipeline
+  v0_3_14_pre_013_security_redaction_covers_gap_repair_and_terminal_paths
+  v0_3_14_pre_013_legacy_v0_v1_remains_proven_after_gap_repair_hardening
+  v0_3_14_pre_013_worker_and_backfill_remain_independent_producers
+
+dependency_boundary
+  v0_3_14_pre_013_cross_layer_closure_keeps_dependency_and_producer_boundaries_exact
+
+hardening
+  v0_3_14_pre_013_cross_layer_completeness_security_closure_is_exact_and_redacted
+
+public_api
+  v0_3_14_pre_013_completeness_closure_adds_no_public_surface
+
+release_completeness
+  v0_3_14_pre_013_cross_layer_closure_canaries_are_complete_without_behavior_or_surface_growth
+```
+
+## Invariants préservés
+
+```text
+aucun code production modifié
+aucune nouvelle dépendance
+aucune nouvelle feature
+aucun changement Config
+aucun changement Transport runtime
+aucun changement Common RAW runtime
+aucun changement Store runtime
+aucune nouvelle API Worker
+aucun Worker -> Job Backfill
+aucun Job Backfill -> Worker
+aucun second pipeline
+aucun nouveau provider
+aucun EARLY/shred
+```
+
+## Fichiers ajoutés
+
+```text
+deltas/0.3.14/pre.013.md
+```
+
+## Fichiers modifiés
+
+```text
+Cargo.toml
+crates/ksp-worker-raw-transaction-ingest-lib/tests/cross_layer_completeness.rs
+crates/ksp-worker-raw-transaction-ingest-lib/tests/dependency_boundary.rs
+crates/ksp-worker-raw-transaction-ingest-lib/tests/hardening.rs
+crates/ksp-worker-raw-transaction-ingest-lib/tests/public_api.rs
+crates/ksp-worker-raw-transaction-ingest-lib/tests/release_completeness.rs
+```
+
+## Fichiers supprimés
+
+```text
+aucun
+```
+
+## Version Cargo
+
+Conformément au workflow prerelease non-fix :
+
+```text
+header Cargo.toml : 587 -> 588
+workspace.package.version : 0.3.14-pre.12 -> 0.3.14-pre.13
+```
+
+## Gate local d'assemblage
+
+Exécuté dans le sandbox après modification :
+
+```text
+General Rust rule audit : clean
+Rust export completeness audit : 0 candidate(s)
+KSP workspace Rust rule audit : clean
+Markdown table audit : clean
+cargo / rustc / rustfmt : NON DISPONIBLES dans le sandbox
+```
+
+Aucune commande Cargo n'est déclarée PASS localement.
+
+## Gate opérateur après application
+
+```bash
+cargo fmt --all
+cargo fmt --all -- --check
+python3 scripts/audit_rust_workspace_rules.py
+python3 scripts/audit_markdown_tables.py README.md RULES.md ROADMAP.md CHANGELOG.md docs prompts crates deltas
+cargo check --workspace
+cargo clippy --workspace --all-targets --all-features -- -D warnings
+cargo test -p ksp-worker-raw-transaction-ingest-lib --all-targets --all-features
+```